Re: ipc-msg broken again on 3.11-rc7?

From: Linus Torvalds <torvalds@linux-foundation.org>
To: Davidlohr Bueso <dave.bueso@gmail.com>
Cc: Vineet Gupta <Vineet.Gupta1@synopsys.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	Davidlohr Bueso <davidlohr.bueso@hp.com>,
	linux-next <linux-next@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Stephen Rothwell <sfr@canb.auug.org.au>,
	Andrew Morton <akpm@linux-foundation.org>,
	linux-mm <linux-mm@kvack.org>, Andi Kleen <andi@firstfloor.org>,
	Rik van Riel <riel@redhat.com>,
	Manfred Spraul <manfred@colorfullife.com>,
	Jonathan Gonzalez <jgonzalez@linets.cl>
Subject: Re: ipc-msg broken again on 3.11-rc7?
Date: Sat, 31 Aug 2013 10:50:53 -0700	[thread overview]
Message-ID: <CA+55aFy8tbBpac57fU4CN3jMDz46kCKT7+7GCpb18CscXuOnGA@mail.gmail.com> (raw)
In-Reply-To: <CAMJEocr1SgxQw0bEzB3Ti9bvRY74TE5y9e+PLUsAL1mJbK=-ew@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 421 bytes --]

Vineet, actual patch for what Davidlohr suggests attached. Can you try it?

             Linus

On Fri, Aug 30, 2013 at 9:31 AM, Davidlohr Bueso <dave.bueso@gmail.com> wrote:
>
> After a quick glance, I suspect that the problem might be because we
> are calling security_msg_queue_msgsnd() without taking the lock. This
> is similar to the issue Sedat reported in the original thread with
> find_msg() concerning msgrcv.

[-- Attachment #2: patch.diff --]
[-- Type: application/octet-stream, Size: 782 bytes --]

 ipc/msg.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ipc/msg.c b/ipc/msg.c
index 9f29d9e89bac..5600c8b0d184 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -687,10 +687,6 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
 		if (ipcperms(ns, &msq->q_perm, S_IWUGO))
 			goto out_unlock1;
 
-		err = security_msg_queue_msgsnd(msq, msg, msgflg);
-		if (err)
-			goto out_unlock1;
-
 		if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
 				1 + msq->q_qnum <= msq->q_qbytes) {
 			break;
@@ -703,6 +699,10 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
 		}
 
 		ipc_lock_object(&msq->q_perm);
+		err = security_msg_queue_msgsnd(msq, msg, msgflg);
+		if (err)
+			goto out_unlock0;
+
 		ss_add(msq, &s);
 
 		if (!ipc_rcu_getref(msq)) {
